Corporate Governance, Enterprise Risk Management & Company Policies

Enterprise Risk Management

The OceanaGold Risk Management Framework is aligned to the ISO31000:2018 Risk Standard, the COSO Enterprise Risk Management Integrated Framework.

The OceanaGold risk management procedures and processes involve the following Risk Management Framework Elements:

• Risk Culture – consistent tone from the top regarding risk, promotion of values and practices aligned to risk outcomes, development and roll out of risk management training, and proactive communication around risk issues.

• Risk Strategy and Governance – clear guidelines on acceptable levels of residual risk and required treatment actions for high and extreme risks, and a formal structure for the management and governance of risk with defined responsibilities and accountabilities.

• Risk Assessment and Measurement – risk identification and assessment is integrated into existing business processes. There is consistent approach to the assessment and measurement of risks based on OceanaGold Risk Matrix, Risk Register Template, and Bowtie Template.

• Risk Management and Monitoring – minimum requirements for monitoring of risks based on residual risk rating and for the monitoring of improvement action completion.

• Risk Reporting and Insights –standardized reporting templates, risk categories map used to drive insights and reporting at an aggregated level, and alignment between the risk program and internal audit.

• Risk Tools and Technology –formal approved templates and guidance for Risk Registers, Bowties and Risk Action Plans.

• Business Processes and Business Planning – risk is considered in all business processes. The outcomes of the risk assessment process feed into the business planning process.